External ID in an external tenant: How to add social login to an existing account

Hey TU2, by default the built-in customer user flows in Microsoft Entra External ID will create a new local user any time a social user signs in and we can’t find an exact match already in the directory. There isn’t an out-of-the-box “link to existing account” toggle in the built-in flows today, but you can get exactly the behavior you want by doing one of the following:

1. Use a custom policy (or a user-flow with a custom authentication extension) to intercept the sign-in, lookup an existing account by email/phone/etc., and then either • Link the social identity to that existing user (so no new account is created) • Or if none is found, fall back to creating a new account as usual
2. Or build a small “link an identity” experience in your app’s profile page, where a logged-in customer can click “Add Google login” (or “Add Facebook login”). Your backend then calls Microsoft Graph (IdentityProvider.ReadWrite) to add the external provider to that user object.

Here are the key docs you’ll want to review:

• Create & customize customer user flows

https://learn.microsoft.com/azure/active-directory/external-identities/customers/how-to-user-flow-sign-up-sign-in-customers

• Add your own business logic with a custom authentication extension

https://learn.microsoft.com/azure/active-directory/external-identities/customers/concept-custom-extensions

• Overview of Microsoft Entra External ID for customers

https://learn.microsoft.com/entra/external-id/customers/overview-customers-ciam

Hope that helps! If you want more tailored guidance, can you share:

1. Are you using built-in user flows or a fully custom policy?
2. Which social ID provider(s) are you integrating (Google, Facebook, custom OIDC, etc.)?
3. By what attribute do you want to detect existing accounts (email, phone, custom)?
4. Do you prefer the link-at-sign-in approach or a post-sign-in “link identity” UX?

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.

Hi @Rukmini

1. Which extension event can intercept the sign-in? Can I get the third-party ID(token) in this extension?
2. Microsoft Graph (IdentityProvider) is not for user's identities

Are you using built-in user flows or a fully custom policy?
--built-in user flows 
Which social ID provider(s) are you integrating (Google, Facebook, custom OIDC, etc.)?
--Google and Facebook 
By what attribute do you want to detect existing accounts (email, phone, custom)? 
--custom 
Do you prefer the link-at-sign-in approach or a post-sign-in “link identity” UX? 
--post-sign-in “link identity”

Hello @TU2

An extension event that can intercept social sign-in and prevent automated user creation for account-linking scenarios is presently not available in built-in user flows. Additionally, the raw Google/Facebook ID token for custom merge/link logic during sign-in is not exposed by custom authentication extensions. A post-sign-in account connection flow is the recommended method for your situation:

1. The user logs in using their current account
2. The user chooses "Link Google/Facebook."
3. Social authentication is finished by your app.
4. Backend uses Microsoft Graph to refresh the user's collection of identities.

Therefore, post-sign-in identity linking is the suggested option for built-in flows.

@Rukmini
1.What do you mean by the step #3? Could you elaborate or provide an example?
2.Is there an Microsoft Graph API to merge a new user object with an existing user object?

Hi @TU2,

• Step #3 indicates that, after the user has signed in, your app immediately completes the Google/Facebook OAuth procedure. Your backend uses Microsoft Graph to add the identity to the current Entra user's identities collection after verifying the social token.
• No, combining two user objects is not supported by Microsoft Graph. The method that is supported is: If a duplicate social account was formed, remove it and assign the social identity to the current user.